40 Architecture, Cryptography & Concepts Practice Questions & Answers

1. 1. Which encryption method uses the SAME single key to both encrypt and decrypt data?

   • A.Symmetric encryption✓ Answer
   • B.Asymmetric encryption
   • C.Hashing
   • D.Public-key encryption

   Symmetric encryption uses one shared secret key for both encryption and decryption; asymmetric encryption uses a public/private key pair.

   Report a problem with this question

2. 2. A security team wants to verify that a downloaded file has not been altered in transit. Which technique BEST provides this integrity check?

   • A.Encrypting the file with AES
   • B.Compressing the file
   • C.Encoding the file in Base64
   • D.Comparing a SHA-256 hash of the file✓ Answer

   A cryptographic hash such as SHA-256 produces a fingerprint that changes if even one bit is altered, so comparing hashes verifies integrity.

   Report a problem with this question

3. 3. Which of the following is a widely used SYMMETRIC block cipher?

   • A.RSA
   • B.AES✓ Answer
   • C.SHA-256
   • D.Diffie-Hellman

   AES (Advanced Encryption Standard) is the dominant symmetric block cipher. RSA and Diffie-Hellman are asymmetric, and SHA-256 is a hash function.

   Report a problem with this question

4. 4. Using asymmetric cryptography, if Alice wants to send Bob a confidential message, which key should she use to encrypt it?

   • A.Alice's private key
   • B.Alice's public key
   • C.Bob's public key✓ Answer
   • D.Bob's private key

   For confidentiality, the sender encrypts with the recipient's public key; only the recipient's matching private key can decrypt the message.

   Report a problem with this question

5. 5. A digital signature is created by encrypting a message's hash with the sender's private key. Which security goals does this PRIMARILY provide?

   • A.Integrity and non-repudiation✓ Answer
   • B.Confidentiality only
   • C.Availability
   • D.Anonymity

   A digital signature proves the message was not altered (integrity) and that only the holder of the private key could have signed it (non-repudiation and authenticity).

   Report a problem with this question

6. 6. In a public key infrastructure (PKI), which entity is responsible for issuing and digitally signing digital certificates?

   • A.The registration authority only
   • B.The end user
   • C.The web browser
   • D.Certificate authority (CA)✓ Answer

   The certificate authority (CA) issues and digitally signs certificates, binding a public key to a verified identity that relying parties can trust.

   Report a problem with this question

7. 7. Adding a unique random value to each password before hashing it, to defeat precomputed rainbow-table attacks, is called:

   • A.Peppering
   • B.Salting✓ Answer
   • C.Key stretching
   • D.Base64 encoding

   A salt is a unique random value added to each password before hashing, so identical passwords hash differently and precomputed rainbow tables become useless.

   Report a problem with this question

8. 8. Which security model assumes no user or device is trusted by default and requires continuous verification for every access request, even from inside the network?

   • A.Defense in depth
   • B.Perimeter (castle-and-moat) security
   • C.Zero trust✓ Answer
   • D.Implicit trust

   Zero trust operates on 'never trust, always verify,' authenticating and authorizing every request regardless of network location.

   Report a problem with this question

9. 9. A company places its public-facing web servers in a separate network segment isolated from the internal LAN by firewalls. What is this segment commonly called?

   • A.VLAN hopping zone
   • B.Intranet
   • C.Air gap
   • D.Screened subnet (DMZ)✓ Answer

   A screened subnet, historically called a DMZ, is a buffer network for public-facing servers, isolating them from the trusted internal LAN.

   Report a problem with this question

10. 10. Which protocol is used to encrypt data in transit for a secure HTTPS web session?

    • A.TLS✓ Answer
    • B.FTP
    • C.Telnet
    • D.SNMPv1

    TLS (Transport Layer Security) encrypts the connection underlying HTTPS. FTP, Telnet, and SNMPv1 transmit data in cleartext.

    Report a problem with this question

11. 11. Layering multiple, independent security controls (firewalls, MFA, encryption, monitoring) so that if one fails others still protect the asset is known as:

    • A.Single sign-on
    • B.Least privilege
    • C.Defense in depth✓ Answer
    • D.Fail-open design

    Defense in depth uses multiple overlapping layers of controls so no single point of failure exposes the protected asset.

    Report a problem with this question

12. 12. Which algorithm allows two parties to securely establish a shared secret key over an insecure channel without ever transmitting the key itself?

    • A.SHA-256
    • B.Diffie-Hellman✓ Answer
    • C.AES
    • D.MD5

    Diffie-Hellman is a key-exchange algorithm that lets two parties derive a shared secret over an insecure channel without sending the secret itself.

    Report a problem with this question

13. 13. A stolen laptop's data remains unreadable because the entire drive is encrypted with BitLocker. This primarily protects data in which state?

    • A.Data in transit
    • B.Data in use
    • C.Data in processing
    • D.Data at rest✓ Answer

    Full-disk encryption like BitLocker protects data at rest—information stored on a drive—so a lost or stolen device does not expose its contents.

    Report a problem with this question

14. 14. A company deploys virtual machines on a cloud provider's Infrastructure as a Service (IaaS) platform. Under the shared responsibility model, which task remains the customer's responsibility?

    • A.Providing physical security for the data center
    • B.Maintaining the physical server hardware
    • C.Patching the hypervisor
    • D.Patching the guest operating systems✓ Answer

    In IaaS, the provider is responsible for everything up to and including the virtualization layer (facility, hardware, hypervisor), while the customer manages everything they install on top of it. Because the customer chooses and runs the guest operating systems, keeping those OS instances patched and hardened is the customer's duty under the shared responsibility model.

    Source: CompTIA Security+ SY0-701 Objective 3.1 — cloud responsibility matrix (IaaS)Report a problem with this question

15. 15. An organization adopts a Software as a Service (SaaS) email platform. Which security responsibility remains with the customer rather than the SaaS provider?

    • A.Managing user accounts, access rights, and the data stored in the service✓ Answer
    • B.Securing the underlying server infrastructure
    • C.Maintaining the availability of the application platform
    • D.Patching the email application code

    SaaS shifts the most responsibility to the provider, which runs the infrastructure, platform, and application. However, in every cloud model the customer always retains responsibility for its own data and identities — classifying data, provisioning accounts, and configuring who can access what — so misconfigured permissions remain the customer's risk.

    Source: CompTIA Security+ SY0-701 Objective 3.1 — cloud responsibility matrix (SaaS); customer retains data and identity responsibilityReport a problem with this question

16. 16. A security team wants visibility into which cloud applications employees use and the ability to enforce corporate policies (such as DLP and access rules) on traffic between users and sanctioned cloud services. Which solution is designed for this purpose?

    • A.A hardware security module (HSM)
    • B.A host-based intrusion detection system (HIDS)
    • C.A network-attached storage (NAS) gateway
    • D.A cloud access security broker (CASB)✓ Answer

    A CASB sits logically between cloud service consumers and cloud providers as a policy enforcement point. Because all cloud-bound activity can be observed and mediated there, it can discover shadow IT, apply data loss prevention, and enforce access and compliance policies — functions that HIDS (host events), NAS (storage), and HSM (key protection) do not provide for cloud application usage.

    Source: CompTIA Security+ SY0-701 — CASB (cloud access security broker): policy enforcement point between cloud users and providersReport a problem with this question

17. 17. An attacker compromises a guest virtual machine and then exploits a flaw in the virtualization software to run code directly on the host and access other tenants' VMs. What is this attack called?

    • A.Container drift
    • B.VM escape✓ Answer
    • C.VM sprawl
    • D.Resource reuse

    VM escape breaks the isolation boundary that the hypervisor is supposed to enforce: code inside a guest exploits a hypervisor vulnerability to execute on the host, from where every co-resident VM can be attacked. VM sprawl is unmanaged VM growth and resource reuse is data leakage through reallocated memory or storage — neither involves breaking out of the guest.

    Source: CompTIA Security+ SY0-701 Objective 2.3 — virtualization vulnerabilities: VM escapeReport a problem with this question

18. 18. Which statement describes a key security difference between containers and traditional virtual machines?

    • A.Containers require a hardware hypervisor, while VMs run directly on the host OS
    • B.Virtual machines cannot be isolated from one another on the same host
    • C.Containers share the host operating system kernel, so a kernel compromise can affect every container on the host✓ Answer
    • D.Containers each run a fully independent kernel, providing stronger isolation than VMs

    Containers virtualize at the operating-system level: all containers on a host run on the same shared kernel, separated only by kernel mechanisms such as namespaces and cgroups. Because that single kernel is a common dependency, a kernel-level exploit can break isolation for every container at once, whereas each VM has its own kernel behind the hypervisor boundary.

    Source: CompTIA Security+ SY0-701 Objective 3.1 — containerization vs. virtualization architecture considerationsReport a problem with this question

19. 19. A company hosts a public-facing web server. Where should this server be placed so that a compromise of the server does not give the attacker direct access to the internal LAN?

    • A.Directly on the Internet with no firewall
    • B.On the internal LAN with host-based antivirus
    • C.On the same VLAN as the domain controllers for easier management
    • D.In a screened subnet separated from the internal network by firewall rules✓ Answer

    A screened subnet (historically called a DMZ) is a buffer network segment that sits between the Internet and the internal network, bounded by firewall interfaces on both sides. Placing Internet-facing services there means an attacker who compromises the web server still faces a second filtered boundary before reaching internal assets, containing the blast radius of the breach.

    Source: CompTIA Security+ SY0-701 Objective 3.2 — infrastructure considerations: screened subnet placementReport a problem with this question

20. 20. In a Zero Trust architecture as described by NIST SP 800-207, which component is responsible for making the decision to grant or deny each access request?

    • A.The Policy Engine in the control plane✓ Answer
    • B.The implicit trust zone surrounding the resource
    • C.The subject requesting the resource
    • D.The Policy Enforcement Point in the data plane

    Zero Trust splits duties between planes: the control plane's Policy Engine evaluates identity, device posture, and context against policy to decide each request, and the Policy Administrator communicates that decision to the data plane's Policy Enforcement Point, which merely opens or closes the session. Keeping decision-making in the control plane is what allows per-request, adaptive trust evaluation instead of implicit network trust.

    Source: CompTIA Security+ SY0-701 Objective 1.2 — Zero Trust control plane (Policy Engine) vs. data plane (PEP); NIST SP 800-207Report a problem with this question

21. 21. What is the primary security benefit of microsegmentation within a data center network?

    • A.It encrypts all data stored on the segmented servers
    • B.It restricts lateral movement by enforcing policy on traffic between individual workloads✓ Answer
    • C.It eliminates the need for authentication inside the perimeter
    • D.It increases total network throughput between servers

    Microsegmentation applies fine-grained security policy down to individual workloads or applications, so east-west traffic inside the network is filtered just like north-south traffic at the perimeter. Because an attacker who compromises one host must then cross explicit policy boundaries to reach any neighbor, the technique directly limits lateral movement, a core goal of zero-trust designs.

    Source: CompTIA Security+ SY0-701 Objective 3.2 — segmentation/microsegmentation to limit lateral movementReport a problem with this question

22. 22. A network engineer is configuring an IPsec site-to-site VPN between two office routers over the Internet. Which IPsec mode should be used so that the entire original IP packet, including its header, is encrypted?

    • A.Transport mode
    • B.Passive mode
    • C.Aggressive mode
    • D.Tunnel mode✓ Answer

    In tunnel mode, IPsec encapsulates and protects the complete original packet — header and payload — inside a new packet whose outer header carries only the gateway addresses, hiding the internal source and destination. Transport mode protects only the payload and leaves the original IP header exposed, which is why tunnel mode is the standard choice for gateway-to-gateway (site-to-site) VPNs.

    Source: CompTIA Security+ SY0-701 Objective 3.2 — IPsec tunnel vs. transport mode (RFC 4301)Report a problem with this question

23. 23. A remote worker's VPN is configured for split tunneling. What does this mean for the worker's network traffic?

    • A.Only traffic destined for corporate resources goes through the VPN, while other Internet traffic goes directly out the local connection✓ Answer
    • B.The VPN alternates between two redundant tunnels for high availability
    • C.All traffic, including general web browsing, is routed through the corporate VPN
    • D.Traffic is split evenly across two ISPs to balance bandwidth

    Split tunneling routes only the subnets or destinations defined as corporate through the encrypted tunnel and lets all other traffic exit the user's local Internet connection directly. This conserves VPN bandwidth and reduces latency, but it is a security trade-off because the direct Internet traffic bypasses corporate inspection and filtering controls.

    Source: CompTIA Security+ SY0-701 Objective 3.2 — remote access VPN: split tunnel vs. full tunnelReport a problem with this question

24. 24. A web server uses ephemeral key exchange (such as ECDHE) for its TLS sessions. If the server's long-term private key is stolen next year, why can the attacker still not decrypt recorded past sessions?

    • A.Because the server rotates its certificate every 24 hours
    • B.Because forward secrecy means each session key was derived from ephemeral values that are discarded and cannot be recovered from the long-term key✓ Answer
    • C.Because recorded ciphertext automatically expires after the session ends
    • D.Because TLS never uses the server's private key for anything

    With ephemeral Diffie-Hellman, the long-term private key is used only to authenticate the handshake; the actual session secret comes from one-time DH values generated fresh for each connection and destroyed afterward. Since the session keys are mathematically independent of the long-term key, its later compromise gives the attacker nothing to decrypt previously captured traffic — the property known as (perfect) forward secrecy.

    Source: CompTIA Security+ SY0-701 Objective 1.4 — key exchange; TLS forward secrecy with ephemeral Diffie-Hellman (ECDHE)Report a problem with this question

25. 25. Two microservices must verify each other's identity before exchanging data over the network. Which TLS configuration meets this requirement?

    • A.Standard TLS, where only the server presents a certificate
    • B.Mutual TLS (mTLS), where both client and server present and validate certificates✓ Answer
    • C.TLS with a self-signed certificate installed only on the server
    • D.Opportunistic TLS, which falls back to plaintext if negotiation fails

    Standard TLS authenticates only the server to the client; the client's identity is never cryptographically proven. Mutual TLS adds a client certificate to the handshake so each side validates the other's certificate chain before the session is established, providing bidirectional authentication — which is why mTLS is common for service-to-service traffic in zero-trust and microservice architectures.

    Source: CompTIA Security+ SY0-701 — mutual authentication; TLS client certificates (RFC 8446)Report a problem with this question

26. 26. An administrator generates a certificate signing request (CSR) to obtain a TLS certificate from a certificate authority. What does the CSR contain?

    • A.The applicant's public key plus identifying information such as the domain name, signed with the applicant's private key✓ Answer
    • B.The CA's root certificate and its private key
    • C.The server's private key so the CA can store a backup
    • D.A symmetric session key for the CA to encrypt the certificate

    A CSR bundles the requester's public key with subject details (such as common name and organization) and is self-signed with the corresponding private key to prove the requester actually possesses it. The private key itself never leaves the requesting system — a fundamental rule of the certificate lifecycle, since anyone holding the private key could impersonate the server.

    Source: CompTIA Security+ SY0-701 Objective 1.4 — certificate signing request (CSR) generation; PKCS #10Report a problem with this question

27. 27. During a TLS connection, a browser needs to confirm that the server's certificate has not been revoked, without downloading a large revocation list. Which mechanism provides this real-time status check?

    • A.Certificate Revocation List (CRL) download
    • B.Certificate transparency logging
    • C.Key escrow lookup
    • D.Online Certificate Status Protocol (OCSP)✓ Answer

    OCSP lets a client query a CA-operated responder for the status of one specific certificate and receive a signed good/revoked/unknown answer, avoiding the bandwidth and staleness problems of downloading an entire CRL. Certificate transparency detects mis-issued certificates in public logs but does not report revocation status, and key escrow concerns key recovery, not validation.

    Source: CompTIA Security+ SY0-701 Objective 1.4 — Online Certificate Status Protocol (OCSP), RFC 6960Report a problem with this question

28. 28. What is the main advantage of OCSP stapling over having each client query the OCSP responder directly?

    • A.It removes the need for the certificate to be signed by a CA
    • B.It allows expired certificates to remain valid until the next staple
    • C.The server fetches a time-stamped, CA-signed OCSP response and delivers it in the TLS handshake, reducing client latency and hiding client browsing from the CA✓ Answer
    • D.It encrypts the OCSP response so third parties cannot read it

    With stapling, the web server periodically obtains a signed OCSP response for its own certificate and 'staples' it into the TLS handshake. Clients validate the CA's signature and timestamp on the stapled response, so they get fresh revocation status without a separate round trip to the responder — which cuts handshake latency, reduces load on the CA, and prevents the CA from learning which sites each client visits.

    Source: CompTIA Security+ SY0-701 Objective 1.4 — OCSP stapling (TLS Certificate Status Request extension, RFC 6066)Report a problem with this question

29. 29. A mobile banking app is configured to accept only a specific known public key for its API server, rejecting any other certificate even if a trusted CA signed it. What is this technique called?

    • A.Certificate pinning✓ Answer
    • B.Certificate wildcarding
    • C.Key stretching
    • D.Certificate chaining

    Pinning hard-codes the expected certificate or public key into the client, replacing 'trust anything a trusted CA signs' with 'trust only this exact key.' This defeats on-path attacks that rely on fraudulently issued or rogue-CA certificates, because even a validly signed impostor certificate fails the pin check; the trade-off is that legitimate key rotation requires updating the app.

    Source: CompTIA Security+ SY0-701 Objective 1.4 — certificate pinningReport a problem with this question

30. 30. A company purchases a wildcard certificate for *.example.com. Which of the following hostnames is covered by this certificate?

    • A.portal.partner-example.com
    • B.shop.eu.example.com
    • C.mail.example.com✓ Answer
    • D.example.org

    A wildcard in a certificate matches exactly one label at the level where the asterisk appears, so *.example.com secures first-level subdomains like mail.example.com or www.example.com. It does not match multi-level names such as shop.eu.example.com (two labels deep), different registered domains, or unrelated TLDs — those require additional SAN entries or separate certificates.

    Source: CompTIA Security+ SY0-701 Objective 1.4 — wildcard certificates; hostname matching rules (RFC 6125)Report a problem with this question

31. 31. What problem does the Diffie-Hellman (DH) algorithm solve in secure communications?

    • A.It produces a fixed-length digest to verify file integrity
    • B.It lets two parties derive a shared secret over an untrusted channel without ever transmitting the secret itself✓ Answer
    • C.It compresses data before encryption to save bandwidth
    • D.It encrypts bulk data faster than any symmetric cipher

    DH solves the key distribution problem: each party combines its own private value with the other party's public value, and the mathematics of the discrete logarithm problem ensures both arrive at the same shared secret while an eavesdropper who sees only the public values cannot feasibly compute it. DH is a key agreement algorithm — it does not itself encrypt bulk data, hash, or compress.

    Source: CompTIA Security+ SY0-701 Objective 1.4 — key exchange: Diffie-Hellman key agreementReport a problem with this question

32. 32. When creating a digital signature for a document, what does the sender's software actually do?

    • A.It hashes the document and signs the digest with the sender's private key✓ Answer
    • B.It signs the document with the sender's public key
    • C.It encrypts the entire document with the recipient's public key
    • D.It hashes the document and encrypts the digest with the recipient's public key

    Signing operates on a hash of the message for efficiency, and the signature must be produced with the sender's private key because only the sender possesses it — that exclusivity is what lets anyone verify the signature with the sender's public key and attribute it to the sender. Using the recipient's public key would provide confidentiality, not authenticity, and a public key cannot create a signature at all.

    Source: CompTIA Security+ SY0-701 Objective 1.4 — digital signatures (FIPS 186: sign with private key, verify with public key)Report a problem with this question

33. 33. Which security property does a digital signature NOT provide by itself?

    • A.Non-repudiation by the signer
    • B.Confidentiality of the message contents✓ Answer
    • C.Authentication of the signer
    • D.Integrity of the signed message

    A digital signature proves the message was not altered (integrity), that it was signed by the holder of the private key (authentication), and that the signer cannot plausibly deny signing it (non-repudiation). It does not encrypt anything — the signed message still travels in readable form unless a separate encryption step is applied, so confidentiality requires an additional mechanism.

    Source: CompTIA Security+ SY0-701 Objective 1.4 — digital signatures provide integrity, authentication, and non-repudiation (not confidentiality)Report a problem with this question

34. 34. A company is worried about sensitive files being exposed if an employee's laptop is lost or stolen while powered off. Which control best addresses this specific risk?

    • A.Enforcing TLS for all web browsing on the laptop
    • B.Requiring a VPN for remote connections
    • C.Full-disk encryption (FDE) on the laptop's drive✓ Answer
    • D.Installing a network intrusion prevention system

    A stolen powered-off laptop is a data-at-rest problem: the attacker has physical possession of the storage media. Full-disk encryption renders every sector unreadable without the decryption key or passphrase, so removing the drive or booting another OS yields only ciphertext. TLS and VPNs protect data in transit and an IPS protects the network — none of them help once the hardware itself is taken.

    Source: CompTIA Security+ SY0-701 Objective 1.4 — encryption levels: full-disk encryption for data at restReport a problem with this question

35. 35. A laptop's full-disk encryption keys are stored so that the disk only decrypts on that specific machine, and the system verifies boot integrity before releasing the keys. Which hardware component provides this capability?

    • A.The CPU's integrated graphics unit
    • B.A Trusted Platform Module (TPM) on the motherboard✓ Answer
    • C.A RAID controller with battery-backed cache
    • D.A network-attached HSM appliance

    A TPM is a tamper-resistant chip bound to a specific motherboard that stores keys and records boot measurements in its platform configuration registers. Because it releases (unseals) the disk encryption key only when the measured boot chain matches the expected values, the drive cannot be decrypted in another machine or after the boot process has been tampered with. An HSM serves centralized enterprise key operations, not per-device sealed storage.

    Source: CompTIA Security+ SY0-701 Objective 1.4 — Trusted Platform Module (TPM); ISO/IEC 11889Report a problem with this question

36. 36. A financial institution must generate, store, and use thousands of cryptographic keys for its payment systems in a tamper-resistant device that never exposes the keys, even to administrators. Which solution fits this requirement?

    • A.A password manager shared by the operations team
    • B.A software keystore file on the application server
    • C.A TPM chip on each administrator's workstation
    • D.A hardware security module (HSM)✓ Answer

    An HSM is a dedicated, certified appliance (or PCIe/network module) built for high-volume enterprise key management: keys are generated inside the hardware boundary, cryptographic operations are performed internally, and tamper-response mechanisms destroy key material if the device is attacked. A TPM protects one platform's keys and a software keystore leaves keys exposed to anyone who compromises the host, which is why regulated payment environments mandate HSMs.

    Source: CompTIA Security+ SY0-701 Objective 1.4 — hardware security module (HSM); FIPS 140-3 validated key storageReport a problem with this question

37. 37. A utility company runs SCADA systems that control physical equipment and cannot be patched frequently. Which hardening measure is the MOST important first step for protecting these systems?

    • A.Exposing the SCADA management interface to the Internet for remote monitoring
    • B.Isolating the control network from the corporate network and Internet through strict segmentation✓ Answer
    • C.Migrating all SCADA workloads to a public SaaS platform
    • D.Installing consumer antivirus on the SCADA controllers

    ICS/SCADA equipment often runs legacy software with long patch cycles, and installing endpoint agents can void vendor support or destabilize real-time operations. Because the devices themselves cannot be fully hardened, the compensating control is to shrink their exposure: strict network segmentation (with firewalls, data diodes, or unidirectional gateways between the control network and everything else) ensures attackers on the corporate network or Internet cannot reach the controllers at all.

    Source: CompTIA Security+ SY0-701 Objectives 3.1/3.2 — ICS/SCADA security considerations; network segmentation as compensating control (NIST SP 800-82)Report a problem with this question

38. 38. Why is network segmentation frequently used as a compensating control for embedded and IoT devices?

    • A.Because IoT devices only support IPv6, which requires separate networks
    • B.Because segmentation increases the processing power available to the devices
    • C.Because embedded devices generate too much log data for a SIEM to process
    • D.Because such devices often cannot receive timely patches or run endpoint security agents, so isolating them reduces their attack exposure✓ Answer

    Embedded and IoT devices commonly have constrained compute resources, vendor-locked firmware, long support gaps, and no ability to host EDR agents, so the usual host-level controls are unavailable. A compensating control addresses the same risk by different means: placing these devices on isolated segments with tightly restricted traffic limits what an attacker can reach from them and what can reach the devices, mitigating the unpatched vulnerabilities that cannot be fixed directly.

    Source: CompTIA Security+ SY0-701 Objective 3.1 — embedded systems/IoT constraints (inability to patch, compute); segmentation as compensating controlReport a problem with this question

39. 39. A server needs storage that keeps running if any single disk fails, while using disk capacity more efficiently than full mirroring. Which RAID level meets both goals?

    • A.RAID 5 — striping with distributed parity across at least three disks✓ Answer
    • B.RAID 0 — striping without parity
    • C.RAID 1 — mirroring across two disks
    • D.JBOD — independent disks with no redundancy

    RAID 5 stripes data across three or more disks and distributes parity blocks among them; when one disk fails, the missing data is reconstructed from the surviving data and parity, so operations continue. It sacrifices only one disk's worth of capacity to parity, unlike RAID 1 which halves usable capacity, while RAID 0 and JBOD tolerate no disk failure at all.

    Source: CompTIA Security+ SY0-701 Objective 3.4 — resilience: RAID levels; RAID 5 single-disk fault tolerance with distributed parityReport a problem with this question

40. 40. In an active-passive high-availability cluster, what happens when the active node stops responding to heartbeat messages?

    • A.The passive node automatically takes over the service — a failover✓ Answer
    • B.The cluster waits for an administrator to manually restart the active node
    • C.All client sessions are permanently dropped until new hardware is installed
    • D.Both nodes shut down to protect data integrity

    In an active-passive design, the standby node continuously monitors the active node's heartbeat; missed heartbeats signal failure, triggering the passive node to assume the service's identity (such as its virtual IP) and continue operations automatically. This automatic failover is the mechanism that delivers high availability — service is restored in seconds without waiting for human intervention.

    Source: CompTIA Security+ SY0-701 Objective 3.4 — high availability: clustering (active-passive), automatic failoverReport a problem with this question

Practice questions based on the CompTIA Security+ SY0-701 exam objectives. This is an independent study tool, not affiliated with or endorsed by CompTIA, and does not grant certification. About Security+ →